Title

The system must prohibit the reuse of passwords within five iterations. (Cat II impact)

Discussion

If a user, or root, used the same password continuously or was allowed to change it back shortly after being forced to change it, this would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.

Check Content

For Trusted Mode: Check the PASSWORD_HISTORY_DEPTH setting. # cat /etc/default/security | grep PASSWORD_HISTORY_DEPTH If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding. For SMSE: Check the PASSWORD_HISTORY_DEPTH setting. # grep PASSWORD_HISTORY_DEPTH /etc/default/security /var/adm/userdb/* If PASSWORD_HISTORY_DEPTH is not set to 5 or greater, this is a finding.

Fix Text

For Trusted Mode: Use the SAM/SMH interface or edit the /etc/default/security file and update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 If manually editing the file, save any change(s) before exiting the editor. For SMSE: Note: There may be additional package/bundle updates that must be installed to support attributes in the /etc/default/security file. Use the SAM/SMH interface (/etc/default/security file) and/or the userdbset command (/var/adm/userdb/* files) to update the PASSWORD_HISTORY_DEPTH attribute. See the below example: PASSWORD_HISTORY_DEPTH=5 Note: Never use a text editor to modify any /var/adm/userdb database file. The database contains checksums and other binary data, and editors (vi included) do not follow the file locking conventions that are used to control access to the database. If manually editing the /etc/default/security file, save any change(s) before exiting the editor.

Additional Identifiers

Rule ID: SV-38417r2_rule

Vulnerability ID: V-4084

Group Title: GEN000800

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.